CVE-2025-47445 HIGH

CVE-2025-47445: WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability

Vendor Arraytics

Product Eventin

Weakness CWE-23

Published May 14, 2025

Last update May 12, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.

Explanation of Vulnerability in Simple Terms

02Summary

Eventin versions up to 4.0.26 contain a path traversal vulnerability that allows unauthenticated attackers to read sensitive files from the server. The vulnerability requires no user interaction and can be exploited over the network. An attacker can access files outside the intended directory structure, potentially exposing configuration files, database credentials, or other confidential data.

What an attacker can do

03Attacker Capabilities

Read arbitrary files from the server without authentication.

Potential impact on your site

04Site Impact

Sensitive files like configuration, credentials, or private data may be exposed to unauthorized parties.

Conditions required to exploit

05Prerequisites

Network access to the Eventin installation; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 14, 2025 CVE published

May 12, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-47445 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/23.html AskarLabs — CWE-23 write-up Relative Path Traversal

Related vulnerabilities